Blog
CVE-2026-104935 (CVSS 8.6): Ivanti Connect Secure Zero-Day Chains to Root — UTA0576 Steals AD Credentials, LAPS Passwords and BitLocker Keys
CVE-2026-104935 lets UTA0576 chain three zero-days to root on Ivanti Connect Secure VPNs, stealing AD credentials, LAPS passwords and BitLocker keys. Patch to 22.8R2.5 or 25.1.3.x now.
Read More →October 2026 Patch Tuesday: Record 1,411 CVEs and an Actively Exploited Windows Shell Zero-Day
Microsoft's October 2026 Patch Tuesday fixes a record 1,411 CVEs including CVE-2026-96951, an actively exploited Windows Shell MotW bypass. CISA KEV-listed; patch now.
Read More →Warlock Ransomware: China-Linked Group Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
China-linked Warlock ransomware group exploits unpatched SharePoint ToolShell CVEs and BYOVD technique to disable EDR across 40 hosts and encrypt 33 in critical infrastructure attacks.
Read More →IDCF Cloud (SoftBank) Ransomware Attack: 495 Organisations Hit in Seven Minutes — Lessons for Every Cloud Tenant
A ransomware attack on Japan's IDCF Cloud (SoftBank Group) hit 495 organisations on 7 October 2026, encrypting 3.6 PB in seven minutes. Here is what happened and how zero-trust principles…
Read More →CVE-2026-76504 (CVSS 9.8): Cisco Catalyst SD-WAN Manager Zero-Day Exploited — Patch Now
CVE-2026-76504 is a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager actively exploited in the wild. CISA's October 3 deadline has passed — here's how to detect, patch, and…
Read More →CVE-2026-104286 (CVSS 9.8): Critical FortiMail Zero-Day Actively Exploited — Patch Now
CVE-2026-104286 is a CVSS 9.8 zero-day in Fortinet FortiMail allowing unauthenticated file writes. CISA added it to KEV with a 3-day federal deadline. Patch or apply workarounds now.
Read More →CVE-2026-105134 (CVSS 10.0): AhsayCBS Backup Zero-Day Actively Exploited — No Patch Confirmed
Two unpatched AhsayCBS flaws (CVE-2026-105133 + CVE-2026-105134) are being actively chained by attackers to gain SYSTEM-level code execution on backup servers. No patch confirmed as of Oct 2026.
Read More →Germany Arrests Qilin’s ‘Snake’: Inside the World’s Most Active Ransomware Gang and What Every Enterprise Must Do Now
Germany-Japan cooperation arrests a Qilin core member. Inside the world's top ransomware gang — $2.88B in demands, 3,954 victims — and how to stop the next attack on your enterprise.
Read More →CVE-2026-102255 (CVSS 10.0): SonicWall SMA1000 Pre-Auth SSRF Under Active Attack — Patch Now
CVE-2026-102255 is a CVSS 10.0 pre-authentication SSRF in SonicWall SMA1000 appliances, patched October 6-7, 2026. Exploitation attempts already observed. No workaround—patch to 12.4.3-03670 or 12.5.0-03082 immediately.
Read More →CVE-2026-76268 (CVSS 9.8): Splunk Enterprise Patroni API Lets Attackers Execute OS Commands Without Credentials
Splunk Enterprise CVE-2026-76268 is a CVSS 9.8 Critical missing-authentication flaw in the Patroni REST API that lets unauthenticated attackers execute OS commands. Patch to 10.4.3 or 10.2.7 immediately.
Read More →